EU AI Act and Your Chatbot or AI Agent: What Article 50 Means You Have to Build

The EU AI Act and your chatbot or AI agent: what Article 50 means you have to build

On 2 August 2026, one part of the EU AI Act started applying to almost every business that runs a chatbot: if an AI system talks to people, those people have to be told they're talking to an AI.

It sounds like a banner and a sentence. In practice it touches the system prompt, the chat interface, the voice opener, how an AI agent introduces itself in an email, and what your assistant says when someone asks "am I talking to a real person?"

Most of what's been written about this rule so far comes from law firms, and it's written for lawyers. This guide is written for the people who have to build it: founders, product owners and engineering leads with a chatbot, voice agent or AI agent that might meet someone in the EU.

We're an AI engineering company. We build AI systems for clients and run our own AI product in production, a website assistant called ConGreeto. So read this knowing two things: we sell in this space, and we found that our own product needed changing. That story is in the middle of this post.

This is general information, not legal advice. For a decision about your own system, talk to a qualified adviser.

What changed on 2 August 2026, and what didn't

The AI Act (Regulation (EU) 2024/1689) has been applying in stages. Article 50, the transparency rules for certain AI systems, applies from 2 August 2026.

For anyone building conversational AI, the key sentence is Article 50(1):

"Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious…"

Note the words designed and developed. This is an obligation on how the system is built, not a line in your privacy policy.

What the Digital Omnibus did and didn't delay. In July 2026 the EU adopted Regulation (EU) 2026/1744, the "Digital Omnibus on AI". It moved the high-risk deadlines: systems in Annex III (areas such as employment and credit) now have until 2 December 2027, and high-risk systems under Annex I until 2 August 2028. It did not move the chatbot rule. Its own recitals say the general date of application stays 2 August 2026. The only transition it adds for Article 50 is a four-month period for the separate duty in Article 50(2) to mark AI-generated content in a machine-readable way, for systems already on the market (Regulation (EU) 2026/1744, recitals 38 and 40).

The European Commission has also published guidelines on how to meet Article 50. They were first published in July 2026, and the version on the Commission's site today is dated 5 November 2026 (European Commission, Article 50 guidelines). The guidelines aren't law, but they're the clearest statement of what regulators will expect, and they're unusually concrete. We quote them by paragraph number below.

Does this apply to a UK, UAE or Saudi business?

Often, yes. Article 50 follows where the system is used, not where the company is.

The guidelines say providers must comply "irrespective of whether they are established or located within the Union or in a third country", and that providers outside the EU are covered "if the output of their AI system is used in the Union" (para. 10). They add that "incidental, unforeseeable or unauthorised downstream use" shouldn't trigger the obligations on its own.

In practice:

A UK e-commerce brand whose website chat serves customers in Ireland, France or Germany is in scope.
A Dubai or Riyadh business whose chatbot is aimed only at Gulf customers is probably not. But if it markets to EU tourists, EU students or EU-based clients, it may well be.
A software company selling an AI product into the EU under its own name is in scope, wherever it's based.

Our view as builders: if there's a realistic chance an EU resident talks to your system, building the disclosure in is a small piece of work. Arguing later about whether you were in scope costs far more.

Provider or deployer: if you had it built, you're probably the provider

Article 50 splits duties between providers (who develop an AI system, or have it developed, and put it on the market or into service under their own name) and deployers (who use an AI system under their authority).

The chatbot disclosure duty in Article 50(1) is a provider duty. Deployers have different duties under Article 50, mainly around emotion recognition, biometric categorisation and deepfakes.

The important detail is in the definition. A provider is someone who develops a system "or has [it] developed" and puts it into service under their own name (Article 3(3), repeated in para. 10 of the guidelines). The guidelines give the example of "a company… that has developed an interactive AI system (e.g. chatbot) in-house and puts it into service in the Union for its own use and under its name" (para. 11).

What this means in practice:

Your situation

Who is most likely the provider

You subscribe to a chatbot product and add it to your site

The vendor that offers the product under its own name

You commissioned a custom chatbot or agent from an agency and run it under your brand

You, because you had it developed and put it into service under your name

You built it in-house

You

If you're commissioning a custom build (from us or anyone else), the disclosure duty most likely sits with you, not the agency. That's a good reason to make it part of the specification, not an afterthought.

What counts as a good disclosure, and what the Commission says isn't enough

The guidelines describe what good looks like for chatbots (para. 37):

Textual disclosure in the interface: "Prominent, plain-language labels or banners (e.g. 'You are interacting with an AI system') and first-turn greetings in chatbots", which "may be combined… with persistent badges or labels visible throughout the interaction".
Placement "close to the interaction interface (e.g. near the input/output field)", in simple wording.
Visual cues such as persistent icons or recognisable "AI" symbols, used consistently.

On timing, "a single, prominent notification before the first interaction… is likely to suffice in most instances" (para. 40), and the information should be given "at least… once at the start of an interactive session", for every new person (para. 143).

Then para. 38 lists what is not enough on its own:

disclosure only in terms and conditions, URLs or documentation;
machine-readable markings, such as metadata, that users can't see;
"unclear or ambiguous signals (e.g. generic references to 'assistant') or human-like representations that may mislead users";
generalised statements such as "Services on this website use AI";
technical descriptions such as "this system uses LLMs".

That third point catches a lot of live chatbots. A widget labelled "Assistant" or "Chat with Sophie", with a smiling stock photo, is exactly the kind of signal the guidelines call ambiguous.

Riskier contexts need more. Para. 40 says periodic reminders are "likely to be necessary" where users are vulnerable (children, the elderly, people with disabilities or lower literacy), in emotionally sensitive conversations, and where there's a higher risk of people being misled, naming "financial advice, insurance, legal assistance, health advice, and complaints handling". If your assistant serves clinics, law firms, insurers or complaints desks, plan for more than a one-off banner.

And it must answer honestly when asked. The same paragraph says providers must design the system "to ensure disclosure in all situations where the AI system is being asked questions relating to its nature", or where it's reasonable to assume the person is confused about it. Hold on to that line. It's the one that caught us.

Voice agents and AI agents: who the AI acts for

Voice. For phone and voice assistants, the guidelines expect "explicit spoken statements at the beginning of the interaction (e.g. 'This is an AI-powered assistant')", with periodic reminders in longer calls, especially after interruptions or a change of role. They state plainly that tones or earcons "are not considered sufficient by themselves" (para. 37). If your voice agent's opening line is "Hi, this is Emma from the clinic", that needs to change.

AI agents. This is the part that most current agent projects aren't ready for. Agents that interact with people while doing tasks, such as "making bookings, managing correspondence, negotiating or concluding contracts, executing purchases", must disclose "both their artificial nature and the person on whose behalf they are acting" (para. 31).

Three consequences for how agents are built:

Identity is per task, not per product. An agent that emails a supplier on behalf of your purchasing team must say it's an AI acting for that team, every time.
If you can't know who's on the other end, disclose anyway. Where the provider can't tell in advance whether an agent will meet a person, it "should be designed at the architecture level, and instructed, to disclose itself as such in every situation where it is reasonably likely" (para. 31). That includes a person acting for a company.
Disclose to your own users too. Agents should also identify themselves "to the persons instructing them at key steps (e.g. at the point of authorisation, reporting, validation…)", including when they're relying on other AI systems' outputs rather than a person's.

Back-end calls between machines whose outputs never reach a person are outside the rule (para. 30). Anything that ends up in front of a human isn't.

The "it's obvious it's a bot" exception, and why it rarely helps

Article 50(1) doesn't apply where it's obvious to a "reasonably well-informed, observant and circumspect" person that they're dealing with an AI. Many teams assume their chatbot qualifies. The guidelines make that hard.

The exception "should be interpreted restrictively" and limited to cases "where there is almost no doubt left" (para. 45). Things that reduce obviousness include human-like writing, a human-sounding voice and "a profile picture related to a chatbot that displays a human". If the system is open to the general public, including vulnerable people, "the exception cannot be relied upon".

The guidelines' own examples of things that don't qualify include "AI chatbots embedded in online platforms or assistance support tools (helpdesks)" where users may think the replies come from a person. Their examples of things that do qualify are narrow: code assistants used only by professional developers, internal tools for trained staff, and characters in single-player games.

If your chatbot faces customers, assume the exception doesn't apply and build the disclosure.

What we had to change in our own product

ConGreeto gives each business's assistant a personality: a name, a voice, a tone and an avatar, so a hotel's assistant can sound warm and a law firm's can sound measured.

When we checked those personalities against Article 50 in October 2026, we found a problem. The written rules behind them told the assistant to speak as the business, and also, in plain words, never to mention AI. If a visitor asked what it was, it was told to deflect with a friendly line about being there to help.

That was a product decision made for conversational flow, well before the transparency rules applied. Measured against para. 40 ("ensure disclosure in all situations where the AI system is being asked questions relating to its nature"), it was simply wrong. A visitor who asked "are you a real person?" deserved a straight answer, and wasn't getting one.

What we changed:

A disclosure rule no personality can override. Every assistant now has a rule that if anyone asks whether they're talking to a person, a bot or an AI, it says plainly that it's an AI assistant for that business, and it never claims to be human. It keeps its name, voice and tone. The rule sits outside the personality, so a business that edits its personality, or an old personality still worded the old way, can't switch it off.
Every stored personality was rewritten, not just the defaults, so no existing assistant kept the old wording.
A permanent "AI assistant" label in the chat widget. It's fixed text that businesses can't remove or rename. It says "AI assistant", not just "assistant", because para. 38 names a generic "assistant" as ambiguous.
Automated tests that check the disclosure rule is always added, that no built-in personality hides being an AI, and that the widget label can't be overridden, so a future change can't quietly undo it.

Two lessons carry over to every client build:

Persona design and disclosure pull against each other. Names, avatars and a natural voice are what make an assistant pleasant to talk to. They're also, in the guidelines' words, what reduce "obviousness". You can keep the persona, but then disclosure has to be explicit, permanent and impossible to switch off.
Put the rule above the layer customers can edit. If disclosure lives only in a prompt that a business owner can rewrite, it will eventually be rewritten.

A build checklist

What we now put into the specification of every conversational AI system we build. Tick each one, and keep evidence of it.

Chat interface

[ ] A visible "AI assistant" (or similar) label near the input field, on every screen of the conversation
[ ] A first message that says it's an AI, before the person has typed anything meaningful
[ ] The label and opener can't be removed by the business's own staff, or only by someone who has accepted that responsibility in writing

Model behaviour

[ ] A rule, outside any editable persona, to answer honestly when asked if it's a person, bot or AI
[ ] No instruction anywhere that tells the model to deny or dodge being an AI
[ ] Reminders in long or sensitive conversations (health, legal, financial, complaints, vulnerable users)
[ ] Tests that fail the build if the disclosure rule is missing

Voice

[ ] A spoken "This is an AI assistant for [business]" at the start of every call
[ ] A reminder after transfers, holds or a change of role
[ ] No reliance on tones alone

AI agents

[ ] Every outbound message, email or call states it's from an AI and who it's acting for
[ ] Disclosure by default wherever a human might be on the other end
[ ] Identification to your own users at approval and reporting steps

Records

[ ] A short written note of who the provider is, which markets the system serves, and how each disclosure is implemented
[ ] Screenshots or recordings of the disclosure as shipped, kept with each release

None of this is expensive if it's planned in from the start. Retrofitting it into a system with several personas, channels and customer-editable prompts takes longer, as we found.

Penalties, briefly

Breaches of Article 50 can be fined up to €15 million or 3% of total worldwide annual turnover, whichever is higher. For SMEs, including start-ups, it's whichever is lower (AI Act Article 99(4) and (6), Regulation (EU) 2024/1689). Member States set the detailed rules and must take account of SMEs' "economic viability" (Article 99(1)).

The bigger risk for most small businesses isn't a fine. It's a customer who finds out the "person" they were confiding in was a bot, and posts about it.

The AI Act also doesn't replace consumer law. The guidelines point out that the EU's Unfair Commercial Practices Directive and Consumer Rights Directive still apply (para. 50), so misleading people about what they're dealing with can be a problem on more than one front.

What to ask your AI vendor

Whether you're buying a chatbot product or having one built, ask:

Who do you consider the provider under Article 50, and why? Get the answer in writing.
How exactly is AI disclosure implemented: interface, opening message, model rule, voice? Ask to see it.
Can our staff remove or reword the disclosure? If yes, who's accountable when they do?
What happens when a user asks "are you human?" Try it yourself, in several phrasings and languages.
Does the system ever tell the model not to mention AI? Ask to see the instructions.
How do your agents identify themselves, and who they act for, in emails and calls?
What evidence of compliance will you hand over at launch?

There's a longer list in our guide to questions to ask an AI development company before you sign.

FAQ

Does my website chatbot need to say it's an AI under the EU AI Act?

If people in the EU can use it, almost certainly yes. Since 2 August 2026, Article 50(1) requires AI systems that interact directly with people to be designed so that people are told they're interacting with an AI, unless that's obvious. The Commission's guidelines say the "obvious" exception is interpreted restrictively, and their examples of chatbots that don't qualify include customer helpdesk bots.

Did the Digital Omnibus delay the chatbot transparency rules?

No. Regulation (EU) 2026/1744 moved the high-risk deadlines to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). The general date for Article 50 stayed 2 August 2026. The only Article 50 transition it added is four months for the machine-readable marking of AI-generated content under Article 50(2), for systems already on the market.

Does the EU AI Act apply to a UK or Middle East company?

It can. The Commission's guidelines say providers outside the EU are covered if their AI system's output is used in the EU, though incidental or unforeseeable use shouldn't trigger it on its own. A UK or Gulf business whose chatbot serves EU customers should plan to comply.

Is a label saying "Assistant" enough?

Probably not on its own. The guidelines list "generic references to 'assistant'" as an ambiguous signal that isn't enough by itself. Use wording that says it's AI ("You're chatting with an AI assistant"), shown before or at the first interaction, ideally with a persistent label near the input field.

What does an AI agent have to disclose?

That it's an AI, and on whose behalf it's acting, whenever it interacts with a person while carrying out a task such as booking, corresponding, negotiating or buying. Where it can't tell whether a person is on the other end, it should disclose wherever that's reasonably likely.

What are the fines for breaching Article 50?

Up to €15 million or 3% of worldwide annual turnover, whichever is higher, or whichever is lower for SMEs and start-ups (Article 99(4) and (6)).

Sources

Regulation (EU) 2024/1689 (the AI Act), Articles 3(3), 50 and 99, EUR-Lex, checked 8 November 2026.
Regulation (EU) 2026/1744 (Digital Omnibus on AI), adopted 8 July 2026, OJ L 24 July 2026, recitals 38 and 40.
European Commission, Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50, first published July 2026; version C(2026) 7702 final, dated 5 November 2026, paragraphs 10, 11, 30, 31, 37, 38, 40, 45, 50 and 143.

All sources checked 8 November 2026. This article is general information, not legal advice.

Related reading

Brillnex Systems builds AI agents, assistants and retrieval systems for businesses, and runs its own AI product in production. If you're planning a chatbot, voice agent or AI agent that will talk to people in the EU, tell us what you're building, or see our AI agent development and RAG implementation services.